Performance Testing

Activities conducted to evaluate all or selected portions of safety and security systems, networks, or programs as they exist at the time of the test. Performance testing includes, but is not limited to, force-on-force exercises, tabletop exercises, knowledge tests, limited-scope performance tests, limited-notice performance tests, penetration testing, vulnerability scanning, continuous automated scanning, and cyber security “red teaming.” Performance testing can be conducted as part of a scheduled appraisal activity (i.e., announced), or without prior knowledge of the entity being tested (i.e., unannounced).